Build Awareness or Undermine It?

About this interactive

Security awareness means people know the risks around them and how to behave to reduce them. Training is one of the main ways to build it, but the Awareness lesson lists many others: policies and handbooks people read and sign, emails about an active scam, a warning at a meeting, simulated phishing, contests and games, a quiet word in person with someone who keeps getting caught, and any messaging channel the company already uses. Contractors, partners and other users of the company's systems are part of the audience too. The lesson's warning is about IT departments that set one standard and model another. The classic case is a new laptop set up with a generic first-login password. Many users never change it, and it shows them what a password looks like, which is the opposite of what the password rules ask for. Anything IT does that contradicts the training, such as asking for a password over the phone, does the same damage. A quick test for each card: does it make people more aware of how to behave safely, or does it show them, by example, that the rules do not really matter?

What you'll learn

Decide whether something a company or its IT team does builds security awareness, through training or any of the other ways the lesson names
Recognize an IT practice, such as a generic first-login password, that sets a double standard and undermines what awareness training teaches

Aligned to

CompTIA Security+

5.6 Given a scenario, implement security awareness practices.

NIST 800-53

AT-2 Literacy Training and Awareness

IA-5 Authenticator Management

Key terms

Security Awareness: The ongoing effort to ensure employees understand security policies, recognize threats, and apply safe behaviors through multiple communication methods beyond formal training alone.
Security Training: A structured program designed to educate employees and stakeholders on security principles, threats, and safe practices to build organizational security awareness.
Default Password: A generic, preset password assigned to a device or account during setup that has not been changed by the user, representing a significant security vulnerability.

Topics

Security Awareness Security Program Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →